THABACHWEU LOCAL MUNICIPALITY 


Change Management 

Policy 



The Thaba Chweu Municipality policies are statements of principles and practices dealing with the on-going 
management and administration of the Municipality’s IT assets. These policies act as a guiding frame of 
reference for how the Municipality deals with everything from its day- to-day IT operational and support 
procedures to comply with security regulations and codes of practice. This “statement of purpose” will guide 
the actions to be taken to achieve that purpose. 
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1. Overview 

Change Management provides a process to apply installations, changes, upgrades, or modifications to 
the IT environment. This covers any and all changes to the hardware, software or applications. The 
change management process includes modifications, additions or changes to the LAN / WAN, Network 
or Server hardware and software, and any other change in the ICT environment. Purpose 

The Change Management Process is designed to provide an orderly method in which changes to the IT 
environment are requested and approved prior to the installation or implementation. The purpose is 
not to question the rationale of a change, but to ensure that all elements are in place, all parties are 
notified in advance, and the schedule for implementation is coordinated with all other activities within 
the Municipality. 


2. Scope 

The scope is for any change that might affect one or more of the server or service environments that the 

Thaba Chweu Municipality rely on to conduct normal business operations. It also includes any event that 

may alter the normal operating procedures. The following will be included but are not limited to the 

change management process: 

• Acquisition of new hardware and/or software, changes in hours of availability, and changes or 
modifications to the infrastructure, environmental changes, hardware and/or software upgrades, 
operations schedule changes, periodic maintenance, unforeseen events and user requests. 

• The above list is not all-inclusive. If you are unsure if a change request should be submitted 
through the change management process contact the Thaba Chweu Security Officer. 

2.1. Change management Process 

• The Thaba Chweu Municipality Security Officer is responsible for pro-active planning in managing 
the ICT environment. 

• All change requests must be submitted as soon as the planning process of change request has been 
completed, but no later than the mandatory deadline of 10:00 a.m. 

• The Requester must obtain management approval of the change prior to submitting a change 
request. This ensures that managers are aware of all changes occurring in their areas of 
responsibility. 

• All Change Requests shall be submitted on the ThabaForm_Change Request_vl.l.pdf document. 
This can be obtained from the Thaba Chweu Security Officer. 

• The Change Request must include sufficient detail so that all areas and systems affected. Anticipate 
the relative impact of the change and how it may affect other areas. 


Author: Sbusiso Langa Review: ICT Committee Approve: [Manager] 

File Name: ThabaPlan_Change Management_vl.lpdf | Policy Page 3 





Thabachweu Local Municipality 


Author: Sbusiso Langa 
Review: ICT Committee 
Approved: [Manager] 
Date: 

Change Management Plan 
Version 1.1 


• Change Request Forms not completed properly will be rejected and returned to the Requester with 
an explanation for the denial. 

2.2. Changes to the original request 

• Once a Change Request has been submitted and a situation arises that the request must be 
updated, corrected, or withdrawn, the Thaba Chweu Security Officer must be notified immediately. 

• The Municipality's Security Officer may decide to continue with the change management process or 
restart the process based on the severity of the change. 

• A new Change Request Form must be completed and submitted to the Security Officer with the 
updates or corrections. An exception to this requirement may be minor corrections in the content 
of the previously submitted change request. 

2.3. Pre-approval procedure 

The following task remains the responsibility of the Change Requester's: 

• Perform risk benefits / risk analysis during the planning phase of the change request. 

• Verify that all equipment, software, hardware, and updates are available before commencing with 
the change. 

• Ensure that a roll-back plan is available should the need arises. 

• Evaluate the impact to the server, services, system or network. 

• Create an installation and configuration plan if new software is to be installed. 

• Obtain approval from the Municipality's Security Officer for requesting the change. 

• Submit a complete, concise, and descriptive Change Request. 

• Change Request Forms not completed properly will be rejected and returned to the Requester with 
an explanation for denial. 

2.4. Post-approval procedure 

• Ensure that the all parties are aware of the date and time of the change with the possible impact. 

• Coordinate proper on-site or on-call support as needed to resolve any problems or answer any 
questions that may occur during installation, or immediately subsequent to installation. 

• Ensure all emergency contact names and numbers are be available prior to the change should the 
need arises to obtain additional or outside support. 

• Report unexpected problems immediately through the Municipality's Security Officer. 

• Provide a status update report after the change process of the change made and the successes and 
failures during the process. 

2.5. Emergency request procedure 
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The problem requires immediate attention where either system failure or mission essential 
requirements are not available and no work around exists. This problem can apply to the system as 
a whole or to a particular site if system access is lost. This type of Change Request will receive an 
immediate initial analysis; however, the initial analysis is not mandatory for approval. The corrective 
action is implemented as soon as the fix is available regardless of change management schedule. The 
appropriate organizational reviews and approvals must be submitted to the Municipality's Security 
Officer as soon as possible changing the status of the request to a severity 1 request. 

2.6. Urgent request (Severity 1) 

The problem is of an urgent nature and can justify an out-of-cycle change. This priority is used for 
problems that meet the Priority 1 requirements, except that a work around exists, or performance 
degradation for which no temporary work-around is available however delay would not cause 
adverse mission impact beyond that of inconvenience. These changes must still be controlled, tested 
and approved prior to implementation on a production system. Change Requests that fall into this 
category may, at the approval of the Manager be submitted after the weekly Change Management 
Deadline for final analysis, coordination and schedule inclusion. 

2.7. Normal request (Severity 2) 

Routine Change Requests are judged less operationally important than Priority 2 or the time frame 
is not critical for implementation. This priority may be used for important software, hardware or 
network maintenance issues such as version upgrades, utility software, etc. This priority may be used 
for development activities or new requirements providing that the activity cannot be accomplished 
with the lower priority. 

2.8. R&D change request (Severity 3) 

This priority is intended primarily for new requirements and for the research, development and 
testing phases of new ICT projects. 


3. Types of Changes: 


The following are examples of candidates for Change Management. This list is not all-inclusive. 
Should there be any doubt on whether a change request form should be submitted refer the request 
to the Municipality's' Security Officer for more information. 

3.1. System Hardware 
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Hardware changes, additions, removals, decommissioning's, re-configurations, re-locations, 
preventive, or emergency maintenance. 

3.2. Systems Software 

Software, service pack, product updates, fixes or feature pack changes, installations, removals, re¬ 
configurations, re-locations, preventative or emergency maintenance. 

3.3. Network Systems 

Additions, modifications, deletions to Front End Programs (FEPs), lines, modems, routers, network 
access, controllers, servers, protocol converters. 


4. Corrective actions for non-policy compliance 

• Failure to comply with the guidelines stipulated in the Municipality's policies will result in the 
following corrective or disciplinary procedures. 

• The decisive action that will be taken against the employee is dependent on the severity level and 
the level of the security risk. 

• Warning from Management: 

o The employee receives a warning from their manager that they were in violation of policy. 

• Written Warning in Personnel File 

o The employee is reprimanded, and official notice is put in their personnel file. This may 
have negative consequences during future performance reviews or promotion 
considerations. 

• Revoking Privileges 

o Access to certain resources, such as internet or email, can be revoked for a limited period 
providing that this action does not have a negative impact on the employee's job functions. 

• Training 

o Adequate training to create awareness and guidance on policy compliance. 

• Disciplinary action will be determined in compliance to Schedule 8 of the Labour Relations Act 66 of 
1995 or other related Public Service Regulations. 

5. Glossary and Abbreviations 


Please refer to the Thaba Chweu Glossary and abbreviations guide. 


Author: Sbusiso Langa Review: ICT Committee Approve: [Manager] 

File Name: ThabaPlan_Change Management_vl.lpdf | Policy Page 6 





Thabachweu Local Municipality 


Author: Sbusiso Langa 
Review: ICT Committee 
Approved: [Manager] 
Date: 

Change Management Plan 
Version 1.1 


Version Control 


Version 

State/Change 

Author 

Date 

1.0 

Original 

Sbusiso Langa 


1.1 

Changes 

Sbusiso Langa 



Author 


Name 

Designation 

Signature 

Contact 

Sbusiso Langa 

Security Officer 


+27 13 235 7376 


Review 


Name 

Designation 

signature 

Date 














Approval 


Name 

Designation 

Signature 

Date 






Author: Sbusiso Langa Review: ICT Committee Approve: [Manager] 

File Name: ThabaPlan_Change Management_vl.lpdf | Policy Page 7 



































